Multiple D-Link routers vulnerable to remote command execution

Overview Multiple D-Link routers are vulnerable to unauthenticated remote command execution. Description Several D-Link routers contain CGI capability that is exposed to users as /applysec.cgi, and dispatched on the device by the binary /www/cgi/ssi. This CGI code contains two flaws: 1. The...

D-Link DIR-866L Cross-Site Scripting Vulnerability

The D-Link DIR-866L is a wireless router from AUO D-Link of Taiwan, China. A cross-site scripting vulnerability exists in the D-Link DIR-866L version 1.03B04. A remote attacker can exploit this vulnerability to execute arbitrary code via the device's common gateway interface...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17512

CVE-2019-17512 affects D-Link DIR-412 devices (A1-1.14WW). The issue arises from web interfaces that allow unauthenticated users to clear the router’s log by invoking log_clear.php with act=clear&logtype=sysact, which could erase attack traces. The NVD entry notes a base score of 6.4 (CVSS2) and ...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

Design/Logic Flaw

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

The CVE-2019-17663 entries describe a cross-site scripting vulnerability in D-Link DIR-866L firmware (version 1.03B04) where HtmlResponseMessage in the device’s common gateway interface can be abused to perform a common injection. Root cause centers on how input data is processed by HtmlResponseM...

CVE-2019-17512: Missing Authentication for Critical Function

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17663: Improper Neutralization of Input During Web Page Generation

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

PT-2019-15178

Name of the Vulnerable Software and Affected Versions D-Link DIR-412 A1 version 1.14WW Description The issue concerns the presence of unauthenticated web interfaces on the affected router. An attacker can exploit this by accessing the "log clear.php" endpoint with specific parameters, such as...

D-Link DIR-880L and DIR-895 L/R Buffer Overflow Vulnerability

The D-Link DIR-880L is a wireless AC1900 dual-band Gigabit cloud router.The D-Link DIR-895 L/R is an AC5300 Wi-Fi tri-band router. A buffer overflow vulnerability exists in the htdocs/fileaccess.cgi component in the D-Link DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. An attacker can exploit this...

CVE-2017-14948

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

Buffer overflow

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

CVE-2017-14948

The CVE-2017-14948 issue affects D-Link DIR-880L (1.08B04) and DIR-895 L/R (1.13b03) due to a buffer overflow in the htdocs/fileaccess.cgi component. A crafted HTTP request where CONTENT_TYPE begins with boundary= and exceeds 256 characters can trigger a buffer overflow, potentially enabling remo...

CVE-2017-14948

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

CVE-2019-17511

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via logget.php, which could be used to discover the intranet network structure...